AI Act, european law without "teeth” in Romania: authorities cannot yet apply sanctions

On Sunday, August 2, 2026, the European Union began the application and control of the new obligations of the AI Act, including the rules on the labeling of content generated or modified with artificial intelligence. Unfortunately, for the time being, in our country, the European law risks remaining, for the time being, without "teeth”: the state has not yet adopted the national normative act that would establish the exact attributions of the authorities, the cooperation mechanisms, the control procedures and the sanctions regime.

From a legal point of view, the AI Act did not have to be transposed into Romanian legislation, since it is a European regulation and is directly applicable in all member states. However, Romania had to adopt the subsequent legislation necessary for the functioning of the national supervision and sanctioning mechanism. As this framework is not yet in force, the European obligations exist and must be respected, but the Romanian authorities cannot effectively control and sanction them.

The European Regulation on Artificial Intelligence formally entered into force on 1 August 2024, and its provisions became applicable in stages. What happened on Sunday, 2 August 2026, is the entry into force of a substantial part of the regulation and the official start of control activities, including with regard to the new transparency obligations.

The European Commission announced on Friday, 31 July, that the European Office for Artificial Intelligence - AI Office - together with the competent national authorities, will start applying the AI Act from 2 August. However, the European institution drew attention to the fact that the efficiency of control depends on the appropriate designation and endowment of the authorities in each Member State.

This is precisely where Romania has lagged behind. Through a Government memorandum, the National Authority for Administration and Regulation in Communications - ANCOM was proposed for the role of national market surveillance authority and single point of contact. However, the memorandum does not take the place of a law that would give the institution effective control and sanctioning powers.

ANCOM has publicly acknowledged that the national regulatory act is still in the process of being drafted. The law must establish the supervisory authorities, their powers, cooperation mechanisms, the control procedure and the regime of sanctions applicable for violations of the AI Act.

"ANCOM or the other competent authorities will be able to verify and sanction non-compliance with the obligations of the Regulation only after the entry into force of the national regulatory act currently in the process of being drafted,” the institution stated in a press release, issued on July 24, regarding the state of implementation of the AI Act in Romania.

Along with ANCOM, the proposed national architecture would include the Financial Supervisory Authority and the National Bank of Romania, for high-risk AI systems in the financial sector, as well as the National Supervisory Authority for the Processing of Personal Data, for certain systems used in biometrics, migration, border control, justice and democratic processes. The National Authority for Consumer Protection, the Labor Inspectorate and other institutions would be given powers in their areas of competence.

Until the adoption of the law, however, this structure exists more on paper. Our country has authorities proposed by memorandum, but it does not yet have a complete legal mechanism through which they can carry out controls and apply the sanctions provided for by the regulation.

The national blockage does not mean that the AI Act is entirely inapplicable in Romania. The European Office for Artificial Intelligence can directly control the providers of general-purpose AI models, as well as the systems offered by the same provider that developed the model on which they are based. The AI Office also has powers over the systems integrated into very large online platforms and very large search engines designated under the Digital Services Act.

The European Office can verify the obligations of providers of general-purpose models, including technical documentation, copyright policy and summary of the content used to train the models. Providers of the most advanced models, which are likely to generate systemic risks, must take additional measures against cyber incidents, large-scale manipulation, loss of human control and threats to fundamental rights.

For other artificial intelligence systems, control mainly lies with national authorities, and here the lack of Romanian legislation creates a major problem of enforcement. The European Data Protection Supervisor separately controls the systems used by the institutions, bodies and agencies of the European Union.

The new transparency obligations stipulate that chatbots and other interactive systems must inform users that they are talking to an artificial intelligence , not with a person. Deepfake images, videos and audio recordings must be labelled, and content generated or modified with AI must contain automatically detectable technical markup.

The rules also cover texts generated or modified with the help of AI, published with the aim of informing the population on matters of public interest. This category includes political, economic, financial, legal, scientific, cultural, public health, security and consumer protection topics.

There is an exception for the press: a text does not have to be labelled if it has been subjected to real human verification and is under editorial control and responsibility. Mere spelling or grammar correction is not sufficient editorial verification. Substantial examination of the information and sources by a person who can approve, modify or reject publication is required.

The European Commission announced that over 180 organisations have signed the Code of Practice on Transparency of AI-generated Content. Adherence to the code is voluntary, but legal transparency obligations are mandatory. Entities that do not adhere must demonstrate by other means that they comply with the regulation.

For systems introduced on the market before August 2, 2026, the obligation of suppliers to integrate automatically detectable technical markings has been postponed until December 2, 2026. Content produced before August 2 does not have to be retroactively labeled.

Penalties for breach of obligations can reach 15 million euros or 3% of the company's annual global turnover. In Romania, however, these penalties cannot be applied by national authorities before the adoption of the internal legislative framework, according to ANCOM.

Thus, while the European Commission has officially started the application of the AI Act, our country enters the new European stage with a directly applicable law, but with a non-functional national control apparatus. Companies have obligations, citizens have rights, the sanctions exist in the regulation, but Romanian institutions do not yet have the necessary legal instruments to effectively implement them.